Cloud Armor preconfigured rules support ModSecurity Core Rule Set (CRS) 4.22 as a rule source. For more information, see Tuning Google Cloud Armor WAF rules. This feature is available in Preview.

Cloud Armor supports a visual Match Condition Builder that allows you to create complex expressions in Common Expression Language (CEL) without writing raw code. For more information, see Use the Match Condition Builder.

Security fixes and enhancements to Cloud Armor preconfigured WAF canary rulesets for v3.0. For more information, see Tuning Google Cloud Armor WAF rules.

The following rulesets have been updated:

• sqli-canary
• xss-canary
• lfi-canary
• rfi-canary
• rce-canary
• methodenforcement-canary
• scannerdetection-canary
• protocolattack-canary
• php-canary
• sessionfixation-canary

Cloud Armor preconfigured WAF rules support for inspection up to the first 64 kB (either 8 kB, 16 kB, 32 kB, 48 kB, or 64 kB) of the request body content is Generally Available.

Security fixes and enhancements to Cloud Armor preconfigured WAF v33-canary rulesets. For more information, see Tuning Google Cloud Armor WAF rules.

The following rulesets have been updated:

• sqli-v33-canary
• xss-v33-canary
• lfi-v33-canary
• rfi-v33-canary
• rce-v33-canary
• methodenforcement-v33-canary
• scannerdetection-v33-canary
• protocolattack-v33-canary
• php-v33-canary
• sessionfixation-v33-canary
• java-v33-canary
• nodejs-v33-canary

The Cloud Armor cve-canary rules include the google-mrs-v202512-id000002-rce signature to help detect and mitigate CVE-2025-55182. For more information, see Cloud Armor preconfigured WAF rules overview.

The Cloud Armor cve-canary rules include the google-mrs-v202512-id000001-rce signature to help detect and mitigate CVE-2025-55182. For more information, see Cloud Armor preconfigured WAF rules overview.

Cloud Armor's Hierarchical security policies that facilitate centralized control, enhanced consistency, operational efficiency, and effective delegation of security policy management is Generally Available.

Cloud Armor supports Autonomous System Numbers (ASNs) in globally scoped edge security policies for Media CDN edge cache services, and it is Generally Available.

Feature

Cloud Armor supports Network Threat Intelligence (NTI) in globally scoped edge security policies for Media CDN edge cache services, and it is Generally Available.

Cloud Armor supports organization-scoped address groups for security policies, and it is Generally Available.

Cloud Armor supports Autonomous System Numbers (ASNs) in globally scoped edge security policies for Media CDN edge cache services in Preview.

Cloud Armor supports internal service security policies for the service mesh to enforce global server-side rate limiting per client in Preview.

Cloud Armor preconfigured WAF rules can now inspect up to the first 64 kB (either 8 kB, 16 kB, 32 kB, 48 kB, or 64 kB) of the request body content in Preview.

Cloud Armor's Hierarchical security policies facilitate centralized control, enhanced consistency, operational efficiency, and effective delegation of security policy management in Preview.

Cloud Armor supports organization-scoped address groups for security policies in Preview.

Cloud Armor supports Network Threat Intelligence (NTI) in globally scoped edge security policies for Media CDN edge cache services in Preview.

Cloud Armor supports JA4 rate limiting key, and it is Generally Available. For more information, see Configure rate limiting.

Cloud Armor support for IP address groups is Generally Available.

Feature

Cloud Armor support for regional internal Application Load Balancers is Generally Available. You can use the regional backend security policy type with this load balancer. For more information, see types of security policies.

Granular models for Cloud Armor Adaptive Protection are now Generally Available. For more information, see the Adaptive Protection overview.

Cloud Armor supports IP address groups in Preview.

Cloud Armor support for Layer 7 filtering in globally scoped edge security policies for Media CDN is now Generally Available.

Cloud Armor supports Layer 7 filtering in globally scoped edge security policies for Media CDN in Preview.

Cloud Armor now supports regional internal Application Load Balancers in public preview. You can use the regional backend security policy type with this load balancer. For more information, see types of security policies.

Cloud Armor Enterprise Paygo (formerly Managed Protection Plus Paygo) is now Generally Available. Learn more about Cloud Armor Enterprise service tiers.

Change

The Cloud Armor premium service tier "Cloud Armor Managed Protection Plus" has been renamed to "Cloud Armor Enterprise." This change is being made to reflect the evolution of Cloud Armor's enterprise features. SKU IDs and pricing are unchanged. The name change does not impact the enrollment status of existing projects, or any features that were part of Managed Protection Plus. Learn more about Cloud Armor Enterprise.

The following new NTI feeds are now available:

• iplist-vpn-providers
• iplist-anon-proxies
• iplist-crypto-miners

For more information about Network Threat Intelligence, see the overview.

The following features are now Generally Available:

• Parsing of the GraphQL content-type
• Support for User IP request headers
• Support for JA3 fingerprints

For more information about parsing GraphQL content, see Apply parsing on custom Content-Type header values. For more information about User IP request headers and JA3, see Configure custom rules language attributes.

Google Cloud Armor integration with reCAPTCHA Enterprise for mobile devices is now in General Availability. See the Cloud Armor bot management overview and the Overview of reCAPTCHA Enterprise for WAF and Google Cloud Armor integration.

You can now enroll your projects into Managed Protection Plus through a pay-as-you-go option (Preview) instead of subscribing for a one year term. Activating Managed Protection Plus PAYGO gives you access to Cloud Armor premium features such as Adaptive Protection, Threat Intelligence, and Advanced Network DDoS Protection, without the requirements of annual commitment and with the ability to cancel anytime. Learn more about what's included and pricing.

DDoS attack visibility is now Generally Available. For more information, see Access DDoS attack visibility telemetry.

Network edge security polices (custom rules) are now available to allowlisted users. For more information about network edge policies, see Types of security policies. In addition, you can learn how to Configure network edge security policies.